CVE-2023-39367

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 37.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-17 · updated 2026-06-17
Weakness: CWE-78

Description

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected products

Peplink Smart Reader: 1.2.0

References

https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867
https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1867

Get alerted when CVE-2023-39367 or the next vulnerability affects your stack